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- The MAILING DATE of this communication appears on the cover sheet with the correspondence address ■ 
Period for Reply 

A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) FROM 
THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 . 1 36(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If the period for reply specified above is less than thirty (30) days, a reply within the statutory minimum of thirty (30) days will be considered timely. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 1 33). 

- Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent temn adjustment. See 37 CFR 1.704(b). 

Status 

1 )S Responsive to communication(s) filed on 18 January 2000 . 
2a)^ This action is FINAL. 2b)n This action is non-finai. 

3) 0 Since this application is in condition for allowance except for fornnal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 1 1 , 453 O.G. 213. 
Disposition of Claims 

4) ^ Claim(s) 7-29 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) n Claim(s) is/are allowed. 

6) ^ Claim(s) 1-29 is/are rejected. 
?)□ Claim(s) is/are objected to. 

8) n Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) n The specification is objected to by the Examiner. 

^0)M The drawing(s) filed on 07 April 2003 is/are: a)S accepted or b)\Z\ objected to by the Examiner. 

Applicant may not request that any objection to the drawlng(s) be held in abeyance. See 37 CFR 1.85(a). 
1 1 iQ The proposed drawing correction filed on is: b)\Z\ approved b)\3 disapproved by the Examiner. 

If approved, corrected drawings are required in reply to this Office action. 

12) [ZI The oath or declaration is objected to by the Examiner. 
Priority under 35 U.S.C. §§119 and 120 

13) 0 Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 1 19(a)-(d) or (f). 

a)nAII b)n Some*c)n None of: 

1 -D Certified copies of the priority documents have been received. 

20 Certified copies of the priority documents have been received in Application No. . 

3.n Copies of the certified copies of the priority documents have been received in this National Stage 
application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 

14) n Acknowledgment is made of a claim for domestic priority under 35 U.S.C. § 119(e) (to a provisional application). 

a) □ The translation of the foreign language provisional application has been received. 

15) n Acknowledgment is made of a claim for domestic priority under 35 U.S.C. §§ 120 and/or 121 . 
Attachment(s) 

1 ) O Notice of References Cited (PTO-892) 4) □ Interview Summary (PTO-41 3) Paper No(s). . 

2) O Notice of Draftsperson's Patent Drawing Review (PTO-948) 5) CH Notice of Informal Patent Application (PTO-152) 

3) □ Infonmation Disclosure Statement(s) (PTO-1449) Paper No(s) . 6) □ Other: 
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DETAILED ACTION 



Claim Rejections - 35 USC § 103 



1 . The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made, 

2. Claimsl-29 are rejected under 35 U.S.C. 103(a) as being unpatentable over Reid et al 
(U.S. 6,182,226) and further in view of Flint et al (U.S. 6,453,419). 

3. As per claims 1,9,12,19,27-29 Reid disclosed a method for analyzing at least one 
gateway in a network, said at least one; gateway having a packet filtering configuration file 
including a plurality of rules, said network having a plurality of addresses (col. 1, lines 59-67 & 
col. 2, lines 1 -4), said method comprising the steps of generating a gateway-zone graph that 
models said network based on said packet filtering configuration file, said gateway-zone graph 
having at least one gateway node corresponding to said at least one gateway and at least two 
zone nodes (col. 7, lines 28-39), wherein said at least one gateway is a packet filtering machine 
and each of said zone nodes correspond to a partitioned collection of said addresses created by 
said at least one gateway (col. 5, lines 45-49); receiving a query inquiring whether one or more 
given services are permitted between at least one source address and at least one destination 
address (col. 5, lines 34-56); 

However Reid failed to disclose evaluating said query against each of said rules associated with 
each gateway node in said gateway-zone graph that is encountered between said at least one 
source address and said at least one destination address. 
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In the same field of endeavor Flint disclosed the regions that the service bridge, and the access 
control decisions. The user draws a graph which starts with service and a to-from set. Next the 
user creates a path consisting of the desired options which can include: time, session counts, 
authentication, encryption, users/groups, WWW filters, ftp filters, email filters, destination 
address re-writes, to addresses and from addresses. The user is building a decision tree (col. 6, 
lines 3-11). 

It would have been obvious to one having ordinary skill in the art at the time the invention was 
made to have incorporated evaluating said query against each of said rules associated with each 
gateway node in said gateway-zone graph that is encountered between said at least one source 
address and said at least one destination address as taught by Flint in the system of Reid to make 
the alarm notification more efficient and be more fault tolerant. 

4. As per claims 2, 13,20 Reid disclosed wherein said rules are expressed as rule-base 
objects (col. 5, lines 64-67 & col. 6, lines 1-3). 

5. As per claims 3,10,14,21 Reid disclosed wherein said gateway-zone graph is derived 
from a network topology file (col. 7, lines 61-67). 

6. As per claims 4,15,22 Reid disclosed wherein said query includes a wildcard for at least 
one of said service, source address or destination address (col. 6, lines 9-15). 

7. As per claims 5,23 Reid disclosed fiirther comprising the step of determining a portion of 
said one or more given services that are permitted between at least one source address and at 
least one destination address (col. 6, lines 9-15). 

8. As per claims 6,1 1,16,24 Reid disclosed fiirther comprising the step of transforming said 
packet filtering configuration files into a table of logical rules that are processed during said 
evaluating step (col. 7, lines 33-39). 
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9. As per claims 7,17,25 Reid disclosed wherein said query consists of a source host-group, 
a destination host-group, and a service host-group (col. 8, lines 20-25 & col. 7, lines 39-59). 

10. As per claims 8,18,26 Reid disclosed wherein said query specifies a location where 
packets are to be inserted into the network that is different from a source address (col. 6, lines 1- 
19). 

Applicant's arguments are as follows: 

1 1 . Applicant argued that prior art did not disclose generating or analyzing a "gateway-zone 
graph that models said network based on said packet filtering configuration file". 

As to applicant's arguments Reid disclosed a plurality of network interfaces which communicate 
with the operating system kernel; and a firewall comprising a plurality of regions, wherein a set 
of pohcies have been configured for each of the plurality of regions (col. 2, lines 6-1 1). 

12. Applicant argued that prior art did not disclose the invention generates the graphical 
model from the rules of one or more firewalls. 

As to applicants arguments Reid disclosed the firewall's access flow diagrams allow any 
decision criteria to be based on any other decision, in any order. If the administrator wants to 
check user first, then time, then apply a specific access policy, they can. In addition, the flow 
diagrams are object oriented for greater power (col. 7, lines 28-33). 
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Conclusion 



13. THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within TWO 
MONTHS of the mailing date of this final action and the advisory action is not mailed until after 
the end of the THREE-MONTH shortened statutory period, then the shortened statutory period 
will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 
CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, 
however, will the statutory period for reply expire later than SIX MONTHS from the mailing 
date of this final action. 

14. Any inquiry concerning this communication or earlier communication from the examiner 
should be directed to Adnan Mirza whose telephone number is (703)-305-4633. 

15. The examiner can normally be reached on Monday to Friday during normal business 
hours. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, David Wiley can be reached on (703)-308-5221. The fax for this group is (703)-746- 
7239. 
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16. The fax phone numbers for the organization where this application or proceeding is 
assigned are as follows: 

(703)-746-7239 (For Status Inquiries, Informal or Draft Communications, please label 
"PROPOSED" or "DRAFT"); 

(703)-746-7239 (For Official Communications Intended for entry, please mark "EXPEDITED 
PROCEDURE"), 

(703)-746-7238 (For After Final Communications). 

17. Any Inquiry of a general nature or relating to the status of this application or proceeding 
should be directed to the receptionist whose telephone number is (703)-305-3900. 

Any response to a final action should be mailed to: 



Commissioner of Patents and Trademarks Washington, D.C.20231 
Or faxed to: 

Hand-delivered responses should be brought to 4^*^ Floor Receptionist, Crystal Park II, 
2021 Crystal Drive, Arlington, VA 22202. 
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Examiner 
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